Continuous auditing operationally requires three things a firm must actually commit to, not just buy: a live data feed from the client's systems rather than a periodic export, a defined process for someone to review and triage exceptions on a short cycle — weekly or more often, not annually — and enough staff capacity allocated specifically to act on what that review surfaces between formal audit cycles.
What the term is usually used to paper over
'Continuous auditing' is often used to describe software that can technically run a reconciliation on demand, which is a real capability but not continuous auditing. Continuous auditing describes an operating rhythm, not a capability. A tool that can run a check anytime is only continuously auditing if someone actually runs it on a defined cadence and does something with what it finds — otherwise it is simply periodic auditing with a faster tool.
The three operational requirements
- 01Live or near-live data access, not a quarter-end exportThis usually means an API or scheduled extract connection to the client's accounting system, refreshed daily or weekly, rather than the client manually sending a file once a quarter. Getting this set up is itself a negotiation with the client's IT or finance team, not a toggle in the audit tool.
- 02A defined exception-triage process with an ownerContinuous data flow generates a continuous stream of exceptions — unmatched items, threshold breaches, anomalies. Someone specific needs to review that stream on a set cadence and decide what's noise and what needs follow-up. Without a named owner and a cadence, the exceptions simply accumulate unread.
- 03Allocated staff time between formal audit cyclesA firm that staffs an engagement only during the annual fieldwork window has no capacity to act on what continuous monitoring surfaces in month four. Continuous auditing requires either a small standing allocation of staff time year-round, or an agreed escalation path to the engagement team when something material surfaces.
A continuous monitoring tool that generates exceptions nobody reviews between annual cycles is worse than no tool at all in one specific way: if something significant surfaced in the exception stream in month six and nobody looked, that stream is now itself a piece of evidence the firm had the information and didn't act on it.
What genuinely changes versus periodic audit
| Dimension | Periodic audit | Genuinely continuous auditing |
|---|---|---|
| Data refresh | Once, at year-end or interim | Daily or weekly throughout the year |
| Exception review | During fieldwork only | On a defined short cycle year-round |
| Staffing | Concentrated in the audit window | A standing allocation or escalation path |
| Value to client | Findings arrive after the fact | Issues surface close to when they occurred |
Common practice, not a requirement
Firms that successfully run continuous auditing on a handful of clients usually start with one high-value control area — bank reconciliation or GST matching, say — rather than attempting it across the whole engagement at once. The operational commitment scales with scope, and most firms underestimate how much review capacity even one control area demands.
How we think about this
Lekhya's view is that continuous auditing is a staffing and process decision a firm makes, which software can support but cannot substitute for. A tool that makes data access and exception surfacing cheap is necessary but not sufficient — the firm still has to decide who reads the output every week.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Technology, data & AI in auditContinuous audit vs periodic audit: which fits a firmWhat actually changes for staffing and client relationships when testing moves off the year-end crunch, and where a year-end wrap-up is still unavoidable.
- Technology, data & AI in auditData analytics in audit: what full-population testing changesThe rare but material exceptions full-population testing surfaces that sampling cannot, and the judgement about what an exception means that no tool replaces.
- Audit workflow & automationThe statutory audit workflow, from evidence collection to sign-offAn engagement end to end: acceptance through to sign-off, with where the time actually goes and the four points at which engagements reliably stall.
- Audit workflow & automationAudit automation for CA firms: what to automate firstHow to decide what to automate, ranked by return rather than by how impressive it sounds, with a scored ranking of common audit tasks and what to leave alone.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.